CVE Vulnerability Catalog

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt", which could be used to bypass the security patch implemented to address CVE-2023-6134.

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

In ssh-agent in OpenSSH before 9.6, destination constraints can be incompletely applied when adding PKCS#11-hosted private keys. Constraints are only applied to the first key, even if the PKCS#11 token returns multiple keys.

The Terrapin vulnerability in the SSH transport protocol affects OpenSSH before 9.6 and many other SSH implementations. A remote attacker can bypass integrity checks by omitting some packets during extension negotiation, causing security features to be downgraded or disabled. This impacts algorithms such as ChaCha20-Poly1305 and CBC with Encrypt-then-MAC.

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.

The 'Create a Space' feature in Silverpeas Core 6.3.1 is reserved for administrators but suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

A vulnerability in Silverpeas Core 6.3.1 administrative 'Bin' feature allows a low-privileged user to access the bin, revealing all deleted spaces. The user can then restore or permanently delete these spaces.

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. An attacker can inject malicious JavaScript code into message content.

Silverpeas Core 6.3.1 has an incorrect access control vulnerability in the 'Porlet Deployer' component, allowing administrators to deploy .WAR portlets. This could lead to unauthorized code execution or privilege escalation.

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

An information disclosure vulnerability in Microsoft Word. Technical details were not provided in the description.

Microsoft Outlook Information Disclosure Vulnerability. Technical details are not available in the description, but the vulnerability may allow data leakage.

A vulnerability in the AnyConnect SSL VPN feature of Cisco ASA and FTD could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This is due to improper validation of the packet's inner source IP after decryption.

NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). This may cause applications using the library to crash.

DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information.

sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized.

In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.